My user enters message with special characters as follows:
this is a test of &&, &&, % as well as \'\' "", &
Try cleansing the input string using htmlspecialchars()
(PHP spec) before adding it to the XML document which should give you the encoding you require.
However if you are not constrained in the way that you create the XML document (i.e. you can do it in a way other than pure string manipulation) I would follow prostynick's solution as it is much more robust in the long term.
You can use DOMDocument
to create xml document and append required elements and text. All characters like &
will be converted to &
etc.